feat: production-grade overhaul — testability, test coverage, CI optimization

[PKramek]

Summary

Production-grade overhaul of the installer, test suite, and CI pipeline addressing testability, coverage gaps, robustness, and a fundamentally broken completions feature.

install.sh refactor + 11 bug fixes

• main() guard: all execution logic wrapped in main() with BASH_SOURCE guard — install.sh can now be sourced safely for unit testing individual functions
• pacman -Sy → -Syu (avoid Arch partial upgrade)
• Fix spurious ERR trap in cleanup
• Broaden ANSI stripping (ESC(B, ESC=, ESC>)
• Clean claude --version output via head -n1
• Normalize boolean options case-insensitively
• Restrict detect_remote_user UID range to 1000-60000
• Whitespace skip uses [^[:space:]]
• Add curl timeouts (30s connect, 300s max)
• Create fish completions dir if missing

Static shell completions (replaces broken dynamic generation)

The previous approach ran claude completions bash at Docker build time, which never worked — it requires authentication unavailable during builds. After 8+ fix iterations polishing a cleanup pipeline for a code path that never succeeded, this PR replaces the entire approach:

• Ship pre-generated bash/zsh/fish completion scripts covering all subcommands and flags
• setup_completions() is now a simple file copy (30 lines replacing 140 lines of ANSI/CRLF/timeout pipeline)
• Completions are always installed — users get working tab completion on first container start
• Delete generate_completion() and the entire dynamic generation pipeline

Test suite overhaul (10 → 17 scenarios)

• completions_pipeline: validates static files are installed, have correct permissions (644), contain expected subcommands and pass integrity checks
• negative_validation: input validation rejection tests for all 3 validators
• security_permissions: file permission and ownership validation
• custom_node_version: nodeVersion=22 binary download path
• fedora_default: RHEL/Fedora code path coverage
• upgrade_version: version upgrade test
• install_path_with_completions: option combination test
• Strengthened 7 existing scenarios (default_options, completions_disabled, mount_host_config, custom_install_path, idempotency, node_preinstalled, multi_feature_combo)
• New helpers: check_completion_file_integrity, check_file_contains, check_file_not_contains, check_no_world_writable
• Completions tests now assert presence — no more "auth likely unavailable" pass-on-absence fallbacks
• Removed orphaned duplicate.sh

CI optimization (27 → 8 images)

• PR matrix reduced from 27 to 8 images (same code path coverage, ~60% faster)
• Nightly extended matrix with 5 additional images
• shfmt download verified with SHA256 checksum
• Positive success assertion in all test jobs (prevents false greens)

Test plan

• All 17 scenarios pass
• All 8 image matrix jobs pass
• arm64 tests pass (ubuntu:24.04, alpine:3.21)
• ShellCheck + shfmt clean
• Completion files always present when shellCompletions=true
• Completion content contains known subcommands (auth, mcp, update)
• Negative validation tests reject all invalid inputs
• Security permissions tests verify correct file modes
• Zero WARNING lines from completions in build logs